diff --git a/docs/rawcli-todo.md b/docs/rawcli-todo.md
index 79fb606..681f6d7 100644
--- a/docs/rawcli-todo.md
+++ b/docs/rawcli-todo.md
@@ -41,7 +41,7 @@ rendered dropdown on a real terminal is the only thing left unautomated.
   authenticate step is the reader's job before these.
 - Autocomplete must work in hex + binary (see the bug above).
 
-## After MFC — 15693 vicinity chips: ICODE SLIX ✅, ICODE SLIX2 ✅, NTAG5 (next)
+## After MFC — 15693 vicinity chips: ICODE SLIX ✅, SLIX2 ✅, NTAG5 ✅, ICODE DNA (next)
 
 1. **15693 header builder** ✅ — `iso15_frame()` (flags + command + NXP mfg 0x04), shared by all
    15693 catalogs. The **full request-flags byte** is settable: sub-carrier (0x01), data-rate,
@@ -68,6 +68,26 @@ count-1`, with the inventory flags set by `iso15_frame(inventory=…, afi=…)`.
 mask-based selective anticollision, and AFI filter all supported. **15693 is now datasheet-complete
 end to end** (flags byte + both SLIX/SLIX2 command sets + inventory-read body).
 
+### NEXT: ICODE DNA catalog (`_DNA`)
+
+DNA is now identified ("ICODE DNA") but borrows `_SLIX2`. Build a dedicated `_DNA` catalog. Sourcing
+(datasheets are local in the repo root — see [[reference_datasheets]] in memory):
+- **Command set + semantics + memory map:** `SL2S6002_SDS.pdf` (the DNA short data sheet). It names
+  the commands but — being the *short* sheet — omits exact opcodes (defers to the NDA full sheet).
+- **Opcodes for the shared commands:** `SL2S2602.pdf` (SLIX2) — DNA extends SLIX2, so EAS/AFI,
+  password (0xB2-B5), READ_SIGNATURE (0xBD), persistent-quiet, etc. carry over. Start from
+  `_SLIX2.commands` like `_NTAG5` did.
+- **DNA-specific:** READ_CONFIG (0xC0) / WRITE_CONFIG (0xC1) — hardware-confirmed on the real DNA;
+  CID (default 0xC000); AES CHALLENGE (0x39) / AUTHENTICATE (0x35) / READBUFFER (0x3A) from
+  `docs/NTAG5_SECURITY.md` (verified protocol) — same crypto sub-protocol as the NTAG5 AES follow-up.
+- **Memory map** (for `memory.py`): user = **63 blocks (0-62)**, **block 63 = 16-bit counter**;
+  **config memory = 48 blocks** via READ_CONFIG (holds keys, CID, originality signature, privileges).
+- Route `"DNA"` → `_DNA` in `catalog_for` (currently → `_SLIX2`). Hardware-verify against the real
+  DNA (finicky: 16-slot inventory + addressed + retries, per [[project_ntag5_dna_id]]).
+
+The NTAG5 AES commands (0x35/0x39/0x3A) follow-up shares this crypto work — source from `NTA5332.pdf`
+(the real NTAG5 Link/Boost datasheet, also local) + `docs/NTAG5_SECURITY.md`.
+
 **Hardware verify pending:** SLIX2 catalog was verified only against unit tests + a live-session
 drive (no SLIX2 tag on the reader). Confirm on a real SLIX2 when one is available.